The ICO has a new name and a new structure

From 30 September 2026, The Information Commissioner - previously a single officeholder with legal personality - has been replaced by a new body corporate called the Information Commission.

For most practical purposes, the change is mostly structural, as the ICO continues to operate under the same name and the same website. Underlying data protection rights are unchanged and any live complaint, investigation or enforcement action that was underway before 30 September continues automatically under the new entity. There is no need for parties to take any action to preserve their position.

The governance of the new body is, however, materially different. The Information Commission is overseen by a board that includes non-executive members, bringing it into line with other major UK regulators. Seven non-executive board members were appointed in July 2026 and took up their roles on 30 September.

Any internal document, privacy notice, data protection policy or client-facing communication that refers to "the Information Commissioner" as the supervisory authority remains legally accurate, with provision in the legislation preserving the existing references. The enforcement powers and penalty framework remain exactly as before. The Information Commission inherits the ICO's full regulatory toolkit, including the power to issue fines of up to £17.5 million or 4% of global annual turnover for serious UK GDPR breaches.

The transition has taken place against a backdrop of internal upheaval at the ICO. Information Commissioner John Edwards voluntarily stepped back from his responsibilities in February 2026 following an independent workplace investigation, with Deputy Commissioner Paul Arnold carrying the Commissioner's functions since June 2026. That situation remains unresolved as the new structure takes effect.